add advice on defining auth scheme parameters

[julian.reschke@…]

When new schemes define new auth parameters, they of course need to stick to the base syntax.

In theory they *can* profile the allowable syntax, but doing so will not work well with consumers that use auth-scheme-agnostic parsers. It's thus best to define auth params based on what a parser would return *after* processing quoted-strings.

[julian.reschke@…]

Proposed patch

[julian.reschke@…]

From [1465]:

Explain that new authentication schemes can not override the parsing rules for WWW-Authenticate with respect to param value syntax, and also add an example for a non-trivial to parse header field instance (see #320)